File Systems Flashcards

1
Q

FAT

A
  • File Allocation Table
  • Used for MS-DOS
  • Simple index table to track files on disks
  • Still the default file system for USB thumb drives and memory cards used with cameras
  • used on the EFI booting partitions
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What are the different types of FAT

A
  • FAT12
  • FAT16
  • FAT32
  • Extended File Allocation Table (exFAT)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What does the number in FAT stand for?

A
  • refers to the number of bits used for clusters addressing

- 12 bit FAT can have a cluster size of 2^12

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Cluster

A
  • smallest logical unit a file system can allocate to a file
  • defined when you format the partition
  • starts at 512 bytes, up to the limit of the file system
  • clusters are logical
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What are the two types of formating?

A
  • High Level (logical) -> initializing the disk
  • Low Level -> usually done at the manufacturer
    • “formatting” in this course is High Level
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What are the 3 “areas” of a FAT file system Structure?

A
  • Reserved Area
  • FAT Area
  • Data Area
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How many Reserved Sectors are there for each type of FAT in the Reserved Area?

A
  • FAT12 = 1 Reserved Sector
  • FAT16 = 1 Reserved Sector
  • FAT32 = 32 Reserved Sectors
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What is in the Reserved Area of both FAT12 and FAT16?

A
  • the entire singe Sector is the Boot Sector
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is in the Reserved Area of FAT32?

A
  • Boot Sector
  • FSINFO
  • Boot Strap
  • Reserved Sectors
    • remember, 32 total sectors in the Reserved Area
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

How do you find FAT#1?

A
  1. Go to the boot sector
  2. Check the value in the “Reserved No. of Sectors” section
  3. Go to that sector value found in (2) leads to FAT#1
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

How do you find FAT#2?

A
  1. Go to the boot sector
  2. Check the value in the “Reserved No. of Sectors” section
  3. Check the value in the “Sectors per FAT” section
  4. Adding value found in (2) with the value found in (3), leads to the location of FAT#2
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Where is the Root Directory located?

A
  • the Root Directory of the file system is located in Cluster #2
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What happens when a file is deleted?

A
  1. the system changes the first character in the file name to 0xE5
  2. the cluster entries for the file in FAT are all zeroed out
  3. the starting cluster in the directory entry is left as it is
  4. the contents of the file ( in clusters ) still exist on the disk (until their clusters are used again).
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Journaling in NTFS

A
  • the file system uses a log file ($LogFile) to store all metadata changes
  • helps with recovery
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is a key difference with NTFS vs. FAT

A
  • based on files and not on dividing the volume into separate spaces
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

File carving

A
  • forensic technique that recovers files based merely on file structure and content from raw data
  • EX: recover deleted file from unallocated disk space
17
Q

TSK

A
  • The SleuthKit

- collection of CLI tools to help analyze disk images and recover files